kms.network

← All comparisons

AWS KMS vs Google Cloud KMS

How AWS KMS and Google Cloud KMS differ on scope, key custody, deployment and cost.

AWS KMSGoogle Cloud KMS
TypeCloud KMSCloud KMS
ScopeEncryption keysEncryption keys
DeploymentSaaS (AWS)SaaS (GCP)
Key custodyFIPS 140-3 Level 3 validated HSMsHSM tier FIPS 140-2 Level 3; External Key Manager for off-cloud keys
How it worksKeys never leave the service — you call it to encrypt and decrypt rather than fetching key material. Envelope encryption is the normal pattern: KMS protects a data key, the data key protects your data. Every AWS service integrates natively, which is most of the value.Key rings and key versions with explicit rotation, offered in software, HSM and external tiers. External Key Manager is the differentiator: the key stays in your own system and Google calls out to it, so the cloud can be denied access by design rather than by policy.
Pricing*$1/key/mo + $0.03 per 10k requestsMetered per key version + operations
Free tierYesNo
Licence——
Best forAnything already running on AWSGCP workloads and hold-your-own-key rules

AWS KMS

  • Integrated with essentially every AWS service
  • Key material never leaves the HSM boundary
  • Trivially cheap at small and moderate scale
  • Manages keys, not application secrets
  • Costs climb with request volume, not key count

Google Cloud KMS

  • Clear key ring and version model
  • External Key Manager is a genuine sovereignty answer
  • Consistent API across software and HSM tiers
  • No free tier
  • External keys add latency and a hard dependency

Bottom line

Choose AWS KMS for anything already running on aws. Choose Google Cloud KMS for gcp workloads and hold-your-own-key rules.

* Published list pricing (vendor pricing pages, August 2026).